

<!DOCTYPE html>
<html lang="zh-CN" data-default-color-scheme=&#34;auto&#34;>



<head>
  <meta charset="UTF-8">
  <link rel="apple-touch-icon" sizes="76x76" href="/img/2.jpg">
  <link rel="icon" type="image/png" href="/img/2.jpg">
  <meta name="viewport"
        content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, shrink-to-fit=no">
  <meta http-equiv="x-ua-compatible" content="ie=edge">
  
  <meta name="theme-color" content="#2f4154">
  <meta name="description" content="">
  <meta name="author" content="K">
  <meta name="keywords" content="">
  <title>docker核心原理-Cgroup-硬件切割 - K</title>

  <link  rel="stylesheet" href="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/css/bootstrap.min.css" />


  <link  rel="stylesheet" href="https://cdn.staticfile.org/github-markdown-css/4.0.0/github-markdown.min.css" />
  <link  rel="stylesheet" href="/lib/hint/hint.min.css" />

  
    
    
      
      <link  rel="stylesheet" href="https://cdn.staticfile.org/highlight.js/10.0.0/styles/github-gist.min.css" />
    
  

  


<!-- 主题依赖的图标库，不要自行修改 -->

<link rel="stylesheet" href="//at.alicdn.com/t/font_1749284_ba1fz6golrf.css">



<link rel="stylesheet" href="//at.alicdn.com/t/font_1736178_kmeydafke9r.css">


<link  rel="stylesheet" href="/css/main.css" />

<!-- 自定义样式保持在最底部 -->


  <script  src="/js/utils.js" ></script>
  <script  src="/js/color-schema.js" ></script>
<meta name="generator" content="Hexo 5.2.0"></head>


<body>
  <header style="height: 70vh;">
    <nav id="navbar" class="navbar fixed-top  navbar-expand-lg navbar-dark scrolling-navbar">
  <div class="container">
    <a class="navbar-brand"
       href="/">&nbsp;<strong>かい</strong>&nbsp;</a>

    <button id="navbar-toggler-btn" class="navbar-toggler" type="button" data-toggle="collapse"
            data-target="#navbarSupportedContent"
            aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation">
      <div class="animated-icon"><span></span><span></span><span></span></div>
    </button>

    <!-- Collapsible content -->
    <div class="collapse navbar-collapse" id="navbarSupportedContent">
      <ul class="navbar-nav ml-auto text-center">
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/">
                <i class="iconfont icon-home-fill"></i>
                首页
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/archives/">
                <i class="iconfont icon-archive-fill"></i>
                归档
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/categories/">
                <i class="iconfont icon-category-fill"></i>
                分类
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/tags/">
                <i class="iconfont icon-tags-fill"></i>
                标签
              </a>
            </li>
          
        
          
          
          
          
            <li class="nav-item">
              <a class="nav-link" href="/about/">
                <i class="iconfont icon-user-fill"></i>
                关于
              </a>
            </li>
          
        
        
          <li class="nav-item" id="search-btn">
            <a class="nav-link" data-toggle="modal" data-target="#modalSearch">&nbsp;<i
                class="iconfont icon-search"></i>&nbsp;</a>
          </li>
        
        
          <li class="nav-item" id="color-toggle-btn">
            <a class="nav-link" href="javascript:">&nbsp;<i
                class="iconfont icon-dark" id="color-toggle-icon"></i>&nbsp;</a>
          </li>
        
      </ul>
    </div>
  </div>
</nav>

    <div class="banner intro-2" id="background" parallax=true
         style="background: url('/img/1.jpg') no-repeat center center;
           background-size: cover;">
      <div class="full-bg-img">
        <div class="mask flex-center" style="background-color: rgba(0, 0, 0, 0.3)">
          <div class="container page-header text-center fade-in-up">
            <span class="h2" id="subtitle">
              
            </span>

            
              <div class="mt-3">
  
  
    <span class="post-meta">
      <i class="iconfont icon-date-fill" aria-hidden="true"></i>
      <time datetime="2020-12-02 14:00" pubdate>
        2020年12月2日 下午
      </time>
    </span>
  
</div>

<div class="mt-1">
  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-chart"></i>
      2k 字
    </span>
  

  
    
    <span class="post-meta mr-2">
      <i class="iconfont icon-clock-fill"></i>
      
      
      23
       分钟
    </span>
  

  
  
</div>

            
          </div>

          
        </div>
      </div>
    </div>
  </header>

  <main>
    
      

<div class="container-fluid">
  <div class="row">
    <div class="d-none d-lg-block col-lg-2"></div>
    <div class="col-lg-8 nopadding-md">
      <div class="container nopadding-md" id="board-ctn">
        <div class="py-5" id="board">
          <article class="post-content mx-auto" id="post">
            <!-- SEO header -->
            <h1 style="display: none">docker核心原理-Cgroup-硬件切割</h1>
            
            <div class="markdown-body" id="post-body">
              <h2 id="Cgroup"><a href="#Cgroup" class="headerlink" title="Cgroup"></a>Cgroup</h2><ul>
<li><p>可以限制被NameSpace隔离起来的资源，还可以为资源设置权重，计算用量等</p>
</li>
<li><p>cgroup全称是 control groups</p>
<p>control groups：控制组，被整合在了linux内核当中，把进程（tasks）放到组里面，对组设置权限，对进程进行控制。可以理解为用户和组的概念，用户会继承它所在组的权限。</p>
<p>cgroups是linux内核中的机制，这种机制可以根据特定的行为把一系列的任务，子任务整合或者分离，按照资源划分的等级的不同，从而实现资源统一控制的框架，cgroup可以控制、限制、隔离进程所需要的物理资源，包括cpu、内存、IO，为容器虚拟化提供了最基本的保证，是构建docker一系列虚拟化的管理工具</p>
</li>
<li><p>cgroup的内核通过hook钩子来实现管理进程资源，提供了一个统一的接口，从单个进程的资源控制到操作系统层面的虚拟卡的过渡</p>
</li>
</ul>
<h2 id="Cgroup的功能"><a href="#Cgroup的功能" class="headerlink" title="Cgroup的功能"></a>Cgroup的功能</h2><p> 1.资源控制: Cgroup通过进程组队资源总额进行限制，例如对内存的总额进行限制等<br> 2.优先级分配: 使用硬件的权重值，当两个程序都需要进程读取cpu，谁优先级高谁占用的资源就多<br> 3.资源统计: 可以统计硬件资源的用量 统计cpu内存等硬件使用的时间<br> 4.进程控制: 可以对进程组实现挂起和恢复操作</p>
<h2 id="术语"><a href="#术语" class="headerlink" title="术语"></a>术语</h2><ul>
<li>task <blockquote>
<p>进程  表示系统中的某一个进程—PID</p>
</blockquote>
</li>
<li>cgroup <blockquote>
<p>控制单位 资源控制，以cgroup来实现，其中cgroup中都是task，但是可以有多个cgroup，可以限制不同的内容，组名不能相同</p>
</blockquote>
</li>
<li>subsystem <blockquote>
<p>子系统 资源调度控制器</p>
</blockquote>
</li>
<li>hierachy <blockquote>
<p>层级树  一堆cgroup构成，包含多个cgroup的叫层级树 可以有多个 hierachy</p>
</blockquote>
</li>
<li>他们之间的关系<blockquote>
<p>一个cgroup中可以有多个task，subsystem相当于控制cgroup限制的类型，hierarchy里面可以有多个cgroup，一个系统可以有多个hierarchy</p>
</blockquote>
</li>
</ul>
<h2 id="层级树的四个规则"><a href="#层级树的四个规则" class="headerlink" title="层级树的四个规则"></a>层级树的四个规则</h2><ol>
<li><p>同一个层级树(hierarchy)可以附加一个或多个子系统(subsystem)</p>
<p><img src="/images/docker/gz1.png" srcset="/img/loading.gif"></p>
<blockquote>
<p>可以看到一个层级树中，有一个cpu_mem_cg的cgroup组下还有两个组cg1和cg2，也就是说在cpu_mem_cg组中添加了cpu和mem两个子系统(subsystem)来同时控制cg1和cg2组中的task进程使用的硬件资源</p>
</blockquote>
</li>
</ol>
<ol start="2">
<li><p>一个子系统(subsystem)可以附加到多个层级树(hierarchy)中，但是只可以附加到没有任何子系统的层级树中</p>
<p><img src="/images/docker/gz2.png" srcset="/img/loading.gif"></p>
<blockquote>
<p>可以看到cpu子系统先附加到了层级树A上了，这时就不能附加到层级树B上了,因为B上有一个mem子系统了，如果B和A都没有任何子系统的话，那么cpu子系统就可以附加到A和B上了</p>
</blockquote>
</li>
</ol>
<ol start="3">
<li><p>一个进程(task)不能属于同一个层级树(hierarchy)的不同cgroup</p>
<p><img src="/images/docker/gz3.png" srcset="/img/loading.gif"></p>
<blockquote>
<p>就是一个系统进程(task)只能当前这个层级树中的一个cgroup出现，当前层级树中的其他cgroup是不能出现第二个相同的task的，但是一个进程(task)是可以在多个层级树(hiearchy)中出现的</p>
</blockquote>
</li>
</ol>
<ol start="4">
<li><p>刚fork出的子进程在初始化状态时是和父进程处于一个cgroup的</p>
<p> <img src="/images/docker/gz4.png" srcset="/img/loading.gif"></p>
<blockquote>
<p>进程(task)创建自己的子进程的时候，新创建出来的(task)默认是和它的父进程在一个cgroup中的,但是该子进程是可以被移除到该层级树(hierarchy)中不同的cgroup中的</p>
</blockquote>
</li>
</ol>
<h2 id="Subsystem-子系统"><a href="#Subsystem-子系统" class="headerlink" title="Subsystem 子系统"></a>Subsystem 子系统</h2><ul>
<li><p>为cgroup组分配调度硬件资源</p>
</li>
<li><p>Subsystem控制选项</p>
<table>
<thead>
<tr>
<th>cpuset</th>
<th>为cgroup中的task分配独立cpu和内存。</th>
</tr>
</thead>
<tbody><tr>
<td>cpu</td>
<td>调度程序控制task对cpu的使用。</td>
</tr>
<tr>
<td>cpuacct</td>
<td>自动生成cpu资源使用情况报告。</td>
</tr>
<tr>
<td>memory</td>
<td>对内存用量的使用限制。同时可以生成使用报告。</td>
</tr>
<tr>
<td>devices</td>
<td>开启/关闭cgroup中task对设备的访问。</td>
</tr>
<tr>
<td>freezer</td>
<td>挂起/恢复cgroup中task。</td>
</tr>
<tr>
<td>net_cls,net_prio</td>
<td>没有被直接使用。通常等级识别符号 （classid）标记网络数据，从而控制流量。</td>
</tr>
<tr>
<td>blkio</td>
<td>为块设备设定输入或输出的限制。</td>
</tr>
<tr>
<td>perf_event</td>
<td>统一的性能测试。</td>
</tr>
<tr>
<td>hugetlb</td>
<td>没有被启用。</td>
</tr>
<tr>
<td>pids</td>
<td>单独对某个pid进行限制</td>
</tr>
<tr>
<td>net_cls</td>
<td>标记网络</td>
</tr>
<tr>
<td>net_prio</td>
<td>网络跟踪</td>
</tr>
<tr>
<td>pids</td>
<td>暂时没有使用，限制单一的PID运行</td>
</tr>
<tr>
<td>systemd</td>
<td>系统资源（进程）</td>
</tr>
</tbody></table>
</li>
<li><p>cgroup查看的位置就是 /sys/fs/cgroup 里面的内容都是子系统，而运行的容器在每个子系统里都有需要控制的选项， 例如 容器A在cpu里的docker组里面存在，也在memery里的docker组里， 那么容器A的task(进程号)会放在这两个子系统的tasks里，进行控制</p>
</li>
</ul>
<h2 id="docker使用cgroup对硬件进行限制"><a href="#docker使用cgroup对硬件进行限制" class="headerlink" title="docker使用cgroup对硬件进行限制"></a>docker使用cgroup对硬件进行限制</h2><ul>
<li>对cpu的限制 （仅对于cpu的使用权重）<table>
<thead>
<tr>
<th>-c</th>
<th>限制使用量(和权重差不多)</th>
</tr>
</thead>
<tbody><tr>
<td>--cpu</td>
<td>容器使用的cpu线程数或者核心数</td>
</tr>
<tr>
<td>--cpu-shares</td>
<td>限制cpu的权重</td>
</tr>
</tbody></table>
</li>
</ul>
<pre><code class="hljs llvm"># 创建两个容器 并给容器设置权重
[root<span class="hljs-title">@localhost</span> ~]# docker run -itd --name aa --cpu-shares <span class="hljs-number">512</span> centos
f<span class="hljs-number">52</span>dc<span class="hljs-number">219</span>a<span class="hljs-number">31191</span>b<span class="hljs-number">931</span>bc<span class="hljs-number">21</span>b<span class="hljs-number">3e2451</span>a<span class="hljs-number">193</span>d<span class="hljs-number">243247233310</span>bb<span class="hljs-number">0181e64274</span>e<span class="hljs-number">266</span>be
[root<span class="hljs-title">@localhost</span> ~]# docker run -itd --name bb --cpu-shares <span class="hljs-number">1023</span> centos
<span class="hljs-number">744815</span><span class="hljs-keyword">c</span><span class="hljs-number">308</span>a<span class="hljs-number">302</span><span class="hljs-keyword">c</span><span class="hljs-number">7</span>addfbfe<span class="hljs-number">69</span>b<span class="hljs-number">526</span>a<span class="hljs-number">70029</span><span class="hljs-keyword">c</span><span class="hljs-number">4</span>de<span class="hljs-number">59</span><span class="hljs-keyword">c</span><span class="hljs-number">6</span>dd<span class="hljs-number">18e4564</span>b<span class="hljs-number">06</span><span class="hljs-keyword">c</span><span class="hljs-number">915</span>f<span class="hljs-number">2</span>a<span class="hljs-number">0</span>a

# 查看cgroup
[root<span class="hljs-title">@localhost</span> ~]# cd /sys/fs/cgroup/cpu/docker/
# 进入到aa容器的文件
[root<span class="hljs-title">@localhost</span> docker]# cd f<span class="hljs-number">52</span>dc<span class="hljs-number">219</span>a<span class="hljs-number">31191</span>b<span class="hljs-number">931</span>bc<span class="hljs-number">21</span>b<span class="hljs-number">3e2451</span>a<span class="hljs-number">193</span>d<span class="hljs-number">243247233310</span>bb<span class="hljs-number">0181</span>
[root<span class="hljs-title">@localhost</span> f<span class="hljs-number">52</span>dc<span class="hljs-number">219</span>a<span class="hljs-number">31191</span>b<span class="hljs-number">931</span>bc<span class="hljs-number">21</span>b<span class="hljs-number">3e2451</span>a<span class="hljs-number">193</span>d<span class="hljs-number">243247233310</span>bb<span class="hljs-number">0181e64274</span>e<span class="hljs-number">266</span>be]# cat cpu.shares 
<span class="hljs-number">512</span> # 这是容器aa的权重

# 进入到bb容器的文件
[root<span class="hljs-title">@localhost</span> docker]# cd <span class="hljs-number">744815</span><span class="hljs-keyword">c</span><span class="hljs-number">308</span>a<span class="hljs-number">302</span><span class="hljs-keyword">c</span><span class="hljs-number">7</span>addfbfe<span class="hljs-number">69</span>b<span class="hljs-number">526</span>a<span class="hljs-number">70029</span><span class="hljs-keyword">c</span><span class="hljs-number">4</span>de<span class="hljs-number">59</span><span class="hljs-keyword">c</span><span class="hljs-number">6</span>dd<span class="hljs-number">18e4564</span>
[root<span class="hljs-title">@localhost</span> <span class="hljs-number">744815</span><span class="hljs-keyword">c</span><span class="hljs-number">308</span>a<span class="hljs-number">302</span><span class="hljs-keyword">c</span><span class="hljs-number">7</span>addfbfe<span class="hljs-number">69</span>b<span class="hljs-number">526</span>a<span class="hljs-number">70029</span><span class="hljs-keyword">c</span><span class="hljs-number">4</span>de<span class="hljs-number">59</span><span class="hljs-keyword">c</span><span class="hljs-number">6</span>dd<span class="hljs-number">18e4564</span>b<span class="hljs-number">06</span><span class="hljs-keyword">c</span><span class="hljs-number">915</span>f<span class="hljs-number">2</span>a<span class="hljs-number">0</span>a]# cat cpu.shares 
<span class="hljs-number">1023</span> # 这里是 容器bb的权重 

# bb比aa的权重高
# --cpu-shares 和 -<span class="hljs-keyword">c</span> 的效果是一样的

[root<span class="hljs-title">@localhost</span> ~]# docker run -itd --name <span class="hljs-keyword">cc</span> -<span class="hljs-keyword">c</span> <span class="hljs-number">2048</span> centos
b<span class="hljs-number">4</span>ab<span class="hljs-number">2030</span>db<span class="hljs-number">36</span>b<span class="hljs-number">6</span>bf<span class="hljs-number">25</span>be<span class="hljs-number">38937</span>d<span class="hljs-number">3</span>aaee<span class="hljs-number">08</span>eb<span class="hljs-number">7</span>bfa<span class="hljs-number">9</span>a<span class="hljs-number">3</span>bb<span class="hljs-number">72e9</span><span class="hljs-keyword">c</span><span class="hljs-number">33</span>d<span class="hljs-number">4459152</span>b<span class="hljs-number">1</span>a<span class="hljs-number">85</span>
[root<span class="hljs-title">@localhost</span> ~]# cd /sys/fs/cgroup/cpu/docker/b<span class="hljs-number">4</span>ab<span class="hljs-number">2030</span>db<span class="hljs-number">36</span>b<span class="hljs-number">6</span>bf<span class="hljs-number">25</span>be<span class="hljs-number">38937</span>d<span class="hljs-number">3</span>aaee<span class="hljs-number">08</span>eb<span class="hljs-number">7</span>bfa<span class="hljs-number">9</span>a<span class="hljs-number">3</span>bb<span class="hljs-number">72e9</span><span class="hljs-keyword">c</span><span class="hljs-number">33</span>d<span class="hljs-number">4459152</span>b<span class="hljs-number">1</span>a<span class="hljs-number">85</span>/

[root<span class="hljs-title">@localhost</span> b<span class="hljs-number">4</span>ab<span class="hljs-number">2030</span>db<span class="hljs-number">36</span>b<span class="hljs-number">6</span>bf<span class="hljs-number">25</span>be<span class="hljs-number">38937</span>d<span class="hljs-number">3</span>aaee<span class="hljs-number">08</span>eb<span class="hljs-number">7</span>bfa<span class="hljs-number">9</span>a<span class="hljs-number">3</span>bb<span class="hljs-number">72e9</span><span class="hljs-keyword">c</span><span class="hljs-number">33</span>d<span class="hljs-number">4459152</span>b<span class="hljs-number">1</span>a<span class="hljs-number">85</span>]# cat cpu.shares 
<span class="hljs-number">2048</span></code></pre>
<ul>
<li><p>对memory的限制</p>
<table>
<thead>
<tr>
<th>-m \--memory</th>
<th>限制内存的使用额度</th>
</tr>
</thead>
<tbody><tr>
<td>-- memory-swap</td>
<td>限制内存+swap的大小</td>
</tr>
</tbody></table>
<pre><code class="hljs vala"><span class="hljs-meta">#对内存进行限制 </span>
[root@localhost ~]# docker run -itd --name dd -m <span class="hljs-number">200</span>M --memory-swap <span class="hljs-number">300</span>M centos
<span class="hljs-number">0</span>ebd1f0babee7b64e114df78a19a4e556d31bc8277f0d01d1b4fed71b2cafa59
[root@localhost ~]# 

<span class="hljs-meta"># 使用过程中，不使用memory-swap，memory-swap会默认为memory的1倍</span>
<span class="hljs-meta"># 如果写上的话 上面的 300M 就相当于 内存加swap的大小了</span>
<span class="hljs-meta"># 所以 swap的大小是100M</span>

<span class="hljs-meta"># swap 分区通常被称为交换分区，这是一块特殊的硬盘空间，即当实际内存不够用的时候，操作系统会从内存中取出一部分暂时不用的数据，放在交换分区中，从而为当前运行的程序腾出足够的内存空间。</span></code></pre>
</li>
<li><p>对blockIO的限制</p>
<blockquote>
<p>bps 每秒读写的数据量<br>iops 每秒输入输出的数据量</p>
</blockquote>
<table>
<thead>
<tr>
<th>--device-read-bps</th>
<th>限制此设备上的读取速度</th>
</tr>
</thead>
<tbody><tr>
<td>--device-write-bps</td>
<td>限制此设备上的写入的速度</td>
</tr>
<tr>
<td>--device-read-iops</td>
<td>通过每秒读取的IO次数来限制此设备的读取速度</td>
</tr>
<tr>
<td>--device-write-iops</td>
<td>通过每秒写入IO次数来限制此设备的写入速度</td>
</tr>
<tr>
<td>-blkio-weight</td>
<td>容器默认从磁盘IO的加权值（也就是权重）有效范围为 10-100</td>
</tr>
<tr>
<td>-blkio-weight-device</td>
<td>针对特定设备的IO加权控制 格式为 DEVICE_NAME:WEIGHT</td>
</tr>
</tbody></table>
<pre><code class="hljs routeros"><span class="hljs-comment"># 限制硬盘的写入性能为 30M</span>
[root@localhost ~]# docker <span class="hljs-builtin-name">run</span> -it --device-write-bps /dev/sda:30MB centos

<span class="hljs-comment"># 进入到容器内 通过 time记录时间，用dd命令测试写入速度</span>
[root@d15bdae342a3 /]# time dd <span class="hljs-attribute">if</span>=/dev/zero <span class="hljs-attribute">of</span>=test.out <span class="hljs-attribute">bs</span>=1M <span class="hljs-attribute">count</span>=800 <span class="hljs-attribute">oflag</span>=direct
800+0 records <span class="hljs-keyword">in</span>
800+0 records out
838860800 bytes (839 MB) copied, 27.2592 s, 30.8 MB/s

real    0m27.369s
user    0m0.000s
sys     0m0.600s
[root@d15bdae342a3 /]# 


<span class="hljs-comment"># Time：追踪一条命令的执行时间 </span>
<span class="hljs-comment"># dd：测试磁盘的读写性能</span>
<span class="hljs-comment"># bs=1M每次读1M</span>
<span class="hljs-comment"># If（input file）：输入文件 zero是特殊目录（zero无限大的空间内容  night   of（out of file）输出到的文件</span>
<span class="hljs-comment"># Bs=1M：一个block块的大小是1M </span>
<span class="hljs-comment"># Count=800：一共做800次</span>
<span class="hljs-comment"># Oflag=direct这个输出不走内存，直接读写硬盘</span>
</code></pre>

</li>
</ul>
<h2 id="cgroup的目录层级"><a href="#cgroup的目录层级" class="headerlink" title="cgroup的目录层级"></a>cgroup的目录层级</h2><p><img src="/images/docker/mlcj.png" srcset="/img/loading.gif"></p>
<ul>
<li>cgroup分为三层</li>
<li>第一层<blockquote>
<p>/sys/fs/cgroup/cpu/ 可以限制host主机所有程序的硬件资源</p>
</blockquote>
</li>
<li>第二层<blockquote>
<p>/sys/fs/cgroup/cpu/docker/ 可以限制docker中所有容器程序的硬件资源</p>
</blockquote>
</li>
<li>第三层<blockquote>
<p>/sys/fs/cgroup/cpu/docker/容器id 可以限制docker单个容器的硬件资源</p>
</blockquote>
</li>
</ul>

            </div>
            <hr>
            <div>
              <div class="post-metas mb-3">
                
                  <div class="post-meta mr-3">
                    <i class="iconfont icon-category"></i>
                    
                      <a class="hover-with-bg" href="/categories/docker/">docker</a>
                    
                  </div>
                
                
                  <div class="post-meta">
                    <i class="iconfont icon-tags"></i>
                    
                      <a class="hover-with-bg" href="/tags/docker/">docker</a>
                    
                  </div>
                
              </div>
              
                <p class="note note-warning">本博客所有文章是以学习为目的，如果有不对的地方可以一起交流沟通共同学习 邮箱:1248287831@qq.com！</p>
              
              
                <div class="post-prevnext row">
                  <article class="post-prev col-6">
                    
                    
                      <a href="/2020/12/03/docker%E6%A0%B8%E5%BF%83%E5%8E%9F%E7%90%86-docker%E6%A1%86%E6%9E%B6%E7%BB%93%E6%9E%84/">
                        <i class="iconfont icon-arrowleft"></i>
                        <span class="hidden-mobile">docker核心原理-框架结构</span>
                        <span class="visible-mobile">上一篇</span>
                      </a>
                    
                  </article>
                  <article class="post-next col-6">
                    
                    
                      <a href="/2020/12/02/dockerPID%E9%9A%94%E7%A6%BB%E9%97%AE%E9%A2%98%E8%A7%A3%E5%86%B3/">
                        <span class="hidden-mobile">docker核心原理-PID隔离问题解决_通过ssh连接容器</span>
                        <span class="visible-mobile">下一篇</span>
                        <i class="iconfont icon-arrowright"></i>
                      </a>
                    
                  </article>
                </div>
              
            </div>

            
          </article>
        </div>
      </div>
    </div>
    
      <div class="d-none d-lg-block col-lg-2 toc-container" id="toc-ctn">
        <div id="toc">
  <p class="toc-header"><i class="iconfont icon-list"></i>&nbsp;目录</p>
  <div id="tocbot"></div>
</div>

      </div>
    
  </div>
</div>

<!-- Custom -->


    
  </main>

  
    <a id="scroll-top-button" href="#" role="button">
      <i class="iconfont icon-arrowup" aria-hidden="true"></i>
    </a>
  

  
    <div class="modal fade" id="modalSearch" tabindex="-1" role="dialog" aria-labelledby="ModalLabel"
     aria-hidden="true">
  <div class="modal-dialog modal-dialog-scrollable modal-lg" role="document">
    <div class="modal-content">
      <div class="modal-header text-center">
        <h4 class="modal-title w-100 font-weight-bold">搜索</h4>
        <button type="button" id="local-search-close" class="close" data-dismiss="modal" aria-label="Close">
          <span aria-hidden="true">&times;</span>
        </button>
      </div>
      <div class="modal-body mx-3">
        <div class="md-form mb-5">
          <input type="text" id="local-search-input" class="form-control validate">
          <label data-error="x" data-success="v"
                 for="local-search-input">关键词</label>
        </div>
        <div class="list-group" id="local-search-result"></div>
      </div>
    </div>
  </div>
</div>
  

  

  <footer class="text-center mt-5 py-3">
  <div class="footer-content">
     <a href="https://space.bilibili.com/39165374" target="_blank" rel="nofollow noopener"><span>LMK</span></a> <i class="iconfont icon-love"></i> <a href="https://github.com/fluid-dev/hexo-theme-fluid" target="_blank" rel="nofollow noopener"><span>Fluid</span></a> 
  </div>
  
  <div class="statistics">
    
    

    
      
        <!-- 不蒜子统计PV -->
        <span id="busuanzi_container_site_pv" style="display: none">
            总访问量 
            <span id="busuanzi_value_site_pv"></span>
             次
          </span>
      
      
        <!-- 不蒜子统计UV -->
        <span id="busuanzi_container_site_uv" style="display: none">
            总访客数 
            <span id="busuanzi_value_site_uv"></span>
             人
          </span>
      
    
  </div>


  

  
</footer>

<!-- SCRIPTS -->
<script  src="https://cdn.staticfile.org/jquery/3.4.1/jquery.min.js" ></script>
<script  src="https://cdn.staticfile.org/twitter-bootstrap/4.4.1/js/bootstrap.min.js" ></script>
<script  src="/js/debouncer.js" ></script>
<script  src="/js/main.js" ></script>

<!-- Plugins -->


  
    <script  src="/js/lazyload.js" ></script>
  



  



  <script defer src="https://cdn.staticfile.org/clipboard.js/2.0.6/clipboard.min.js" ></script>
  <script  src="/js/clipboard-use.js" ></script>



  <script defer src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" ></script>





  <script  src="https://cdn.staticfile.org/tocbot/4.11.1/tocbot.min.js" ></script>
  <script>
    $(document).ready(function () {
      var boardCtn = $('#board-ctn');
      var boardTop = boardCtn.offset().top;

      tocbot.init({
        tocSelector: '#tocbot',
        contentSelector: '#post-body',
        headingSelector: 'h1,h2,h3,h4,h5,h6',
        linkClass: 'tocbot-link',
        activeLinkClass: 'tocbot-active-link',
        listClass: 'tocbot-list',
        isCollapsedClass: 'tocbot-is-collapsed',
        collapsibleClass: 'tocbot-is-collapsible',
        collapseDepth: 0,
        scrollSmooth: true,
        headingsOffset: -boardTop
      });
      if ($('.toc-list-item').length > 0) {
        $('#toc').css('visibility', 'visible');
      }
    });
  </script>



  <script  src="https://cdn.staticfile.org/typed.js/2.0.11/typed.min.js" ></script>
  <script>
    var typed = new Typed('#subtitle', {
      strings: [
        '  ',
        "docker核心原理-Cgroup-硬件切割&nbsp;",
      ],
      cursorChar: "_",
      typeSpeed: 70,
      loop: false,
    });
    typed.stop();
    $(document).ready(function () {
      $(".typed-cursor").addClass("h2");
      typed.start();
    });
  </script>



  <script  src="https://cdn.staticfile.org/anchor-js/4.2.2/anchor.min.js" ></script>
  <script>
    anchors.options = {
      placement: "right",
      visible: "hover",
      
    };
    var el = "h1,h2,h3,h4,h5,h6".split(",");
    var res = [];
    for (item of el) {
      res.push(".markdown-body > " + item)
    }
    anchors.add(res.join(", "))
  </script>



  <script  src="/js/local-search.js" ></script>
  <script>
    var path = "/local-search.xml";
    var inputArea = document.querySelector("#local-search-input");
    inputArea.onclick = function () {
      searchFunc(path, 'local-search-input', 'local-search-result');
      this.onclick = null
    }
  </script>



  <script  src="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.js" ></script>
  <link  rel="stylesheet" href="https://cdn.staticfile.org/fancybox/3.5.7/jquery.fancybox.min.css" />

  <script>
    $('#post img:not(.no-zoom img, img[no-zoom]), img[zoom]').each(
      function () {
        var element = document.createElement('a');
        $(element).attr('data-fancybox', 'images');
        $(element).attr('href', $(this).attr('src'));
        $(this).wrap(element);
      }
    );
  </script>















</body>
</html>
